Case 1:06-cv-01944-JR Document 3-10 Filed 11/20/2006 Page 1 of 19 



^AQ 440 (Rev. 8/01) Summons in a Civil Action 



United States District Court 



EASTERN 



District of 



NEW YORK 



MICHAEL ROSATO, MURRY B. MOSKOWITZ, 

and BRUCE OUELLETTE, on their own behalf 

and on behaif of all others similarly situated, 

V. 

R. JAMES NICHOLSON, in his Official Capacity 

as Secretary of Veterans Affairs, 810 Vermont 

Avenue, NW., (see attachment) 



SUMMONS IN A CIVIL ACTION 

CVj 06 3086 



CASE 



TO! (Name and address of Defendant) 

R. James Nicholson, in his Official Capacity as Secretary of Veterans 
Affairs and United States Department of Veterans Affairs, 810 Vermont 
Avenue, NW, Washington. DC 20420 



YOU ARE HEREBY SXJMMONED and required to serve on PLAINTIFF'S ATTORNEY (name and address) 

WEISS & LURIE 
551 Fifth Avenue 
New Yori<. New York 10176 



an answer to the complaint which is served on you with this summons, within _ 



20 



^ days after service 



of this summons on you, exclusive of the day of service. If you fail to do so, judgment by default will be taken against you 
for the relief demanded in the complaint. Any answer that you serve on the parties to this action must be filed with the 
Clerk of this Court within a reasonable period of time after service. 



P TjffJt-ifM/^B^ 
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06 3086 



CIVIL ACTION NO. 



COMPLAINT 






en 



-X) 



JURY TRL^L DEM;&^ED 



UNITED STATES DISTRICT COURT 
EASTERN DISTRICT OF NEW YORK 

MICHAEL ROSATO, MURRY B. MOSKOWTTZ, 
and BRUCE OUELLETTE, on their own behalf and 
on behalf of all others similarly situated, 

Plaintiffs, 



R. JAMES NICHOLSON, in his Official Capacity 
as Secretary of Veterans Affairs, 
8 1 Vermont Avenue, NW, 
Washington, DC 20420, and 

UNITED STATES DEPARTMENT OF 
VETERANS AFFAIRS, 
810 Vermont Avenue, NW, 
Washington, DC 20420, 

Defendants. 



COME NOW PLAINTIFFS, Michael RosatQ, Murry B. Moskowitz and Bruce Ouellette, 
and in support of their Complaint herein allege as follows: 

NATURE OF THE ACTION 

1 . This is a class action for declaratory and injunctive relief and money damages for 
the violations of the Administrative Procedures Act and the Privacy Act of 1 974 and the Fourth 
and Fifth Amendments to the United States Constitution under the authority of Bivens v. Six 
Unknown Named Agents of the Federal Bureau of Narcotics, 403 U.S. 388 (1971). Plaintiffs 
represent approximately 26.5 million individuals who are both veterans and active service 
members of the Armed Services of the United States who have suffered emotional trauma, have 
been placed in fear of identity theft, destruction of credit and financial fi*aud, and who have had 
their private and personal health care information compromised because of Defendants' 



m 
o 
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intentional, willful and reckless disregard for the security and privacy of these citizens' basic 
personal information. 

2. Defendant Nicholson failed to properly perform the duties of his position as 
Secretary of Veterans Affairs ("Secretary*) and did not protect the privacy rights of Plaintiffs and 
the other class members and failed to institute and enforce procedures mandated by law for the 
protection of veterans' and service members* private and personal information. 

3. Defendant United States Department of Veterans Affairs ("Department" or "VA") 
also did not assure that class members' privacy rights were protected, failed to institute and 
enforce procedures mandated by law for the protection of veterans* and service members' private 
and personal information, and flagrantly disregarded the privacy rights of virtually all armed 
service members by illegally maintaining a database of personal information unrelated to claims 
for benefits and by requiring that veterans' and service members' records be maintained and 
accessed through their individual, private and personal social security numbers or other 
identifiers that were required by law to be kept confidential. 

4. Defendants compounded their disregard for veterans* and service members' 
privacy rights by recklessly failing to make even the most rudimentary effort to safeguard this 
trove of personally identifiable information firom unauthorized disclosure. In fact, the 
information was unencrypted, easily copied, and, apparently, available to anyone aware of its 
existence. Defendants' failures, despite repeated calls for correction of these long-standing, 
fundamental security deficiencies, allowed millions of citizens' private information to be 
compromised and disclosed to unknown individuals for unknown purposes. 

5. Defendants improperly, unlawfully, willfully and intentionally disclosed the 
private and personal information of Plaintiffs and the Class in at least three ways: (1) through 
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VA employees' improper access and removal of data files containing the private personal 
information of 26.5 million veterans and active service members from the VA; (2) through the 
transfer by VA personnel of the data to external and unprotected disks and/or computers; and (3) 
through the alleged theft of these disks and/or computers by a third party or parties, whose 
identity may never be known. 

6. The result of Defendants' reckless disregard of the privacy rights of the Class was 
the largest unauthorized disclosure of Social Security numbers, addresses, telephone numbers 
and health information in history. 

7. Defendants' actions and inactions have inflicted serious harm and will continue to 
inflict real costs and emotional pain and suffering on Plaintiffs and every other Hving veteran and 
their families whose identities and other personal and private information have been 
compromised. 

8. Defendants' willful and intentional failure to establish and enforce appropriate 
safeguards to ensure the security and privacy of veteran records and to protect against any known 
or anticipated threats or hazards to the security and integrity of these records is in violation of 5 
U.S.C. § 552a(e)(10) and other laws. Furthermore, subsequent to learning of the foregoing 
unauthorized disclosures, Defendants were deliberately indifferent in failing to take reasonable 
corrective action, including but not limited to, providing prompt and accurate notification of the 
disclosures to law enforcement and the affected veterans despite knowledge of the substantial 
risk of serious harm to the personal and financial security of the affected veterans as result of the 
disclosures. 
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JURISDICTION AND VENUE 

9. Jurisdiction of this Court is invoked pursuant to 28 U.S.C. § 1 33 1 because this is 
a civil action arising under the laws of the United States, Jurisdiction is also invoked pursuant to 
5 U.S.C. §§ 552a(g)(5) because this is a civil action to enforce a liability created under 5 U.S.C. 
§ 552a after September 27, 1975. 

10. Venue is appropriate pursuant to 5 U.S.C. §552a(g)(5) and 28 U.S.C. § 1391(e). 

1 1 . Plaintiff Michael Rosato is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Suffolk County, New York. 

12. Plaintiff Murry B. Moskowitz is a veteran of the United States Armed Services 
honorably discharged from service. He is a resident of Fairfax County, Virginia. 

1 3 . Plaintiff Bruce Ouellette is a disabled Vietnam combat veteran and a current 
resident of Yavapai County, Arizona. 

1 4. Defendant R. James Nicholson is the Secretary of Veterans Affairs and is the 
official responsible for the proper execution and administration of all laws administered by the 
Department and for the control, direction, and management of the Department. 

1 5. Defendant VA is an executive department of the federal government and is, 
therefore, an "agency" for purposes of the Privacy Act of 1974. 

STATEMENT OF FACTS 

1 6. Upon information and belief, VA employees were able to easily access computer 
files containing priyate Personal Information of millions of veterans and copy the files from the 
VA's system onto external disks and their personal computers. Upon ftirther information and 
belief, VA employees had, in fact, been removing the data from the VA facility for a period of 
three years in a practice expressly or implicitly ratified by the VA. VA employees' access to and 

4 
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duplication of this information was a disclosure in violation of 5 U.S.C. 552a(b) and the result of 
Defendants' willful and intentional failure to establish appropriate safeguards to ensure the 
security and confidentiality of veteran records and to protect against any anticipated threats or 
hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

1 7. On May 3, 2006, a laptop computer and external data storage device or devices 
were reportedly stolen from the Aspen Hill, Maryland home of John Doe, a VA employee. The 
laptop computer and data storage device or devices contained a copy of a collection or grouping 
of information pertaining to approximately 26.5 million persons (the "Personal Information"), 
including military veterans and approximately 2.2 million current active service members and 
their spouses (or nearly 80 percent of the active duty force). The Personal Information contained 
individual identifying information including, but not limited to, names, addresses, phone 
numbers, social security numbers, dates of birth and health information. In addition, at least 
three hundred of the records contained disability information and information related to possible 
exposure to biological and chemical agents. None of the information was encrypted or similarly 
protected. 

1 8. Upon information and belief, John Doe had removed the VA files containing the 
private personal information of 26.5 million veterans from the VA facility and taken it to his 
home shortly before the theft described in the prior paragraph. John Doe then copied the files 
onto his computer and/or extemal disks for an unspecified purpose. John Doe's computer and/or 
disks were allegedly stolen during a burglary of his home. Upon information and belief, these 
items have not been recovered as of the date of the filing of this Complaint. They were not 
encrypted or password protected and are easily accessed and duplicated. 
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1 9. John Doe reported the Personal Information theft to one or more VA officials. 
These VA officials were aware of the unlawful disclosure of the Personal Information soon after 
the occurrence, yet these VA officials willfully and intentionally decided to conceal the 
disclosure and did not report the incident to other VA officials, federal law enforcement, or 
inform the individuals whose Personal Information had been disclosed without authorization. 
These failures exhibit Defendants' reckless disregard for Plaintiffs' privacy rights, intentional 
and willftil violations of the Privacy Act, and were otherwise not in accordance with law. 

20. No VA official charged with protecting the Personal Information pursuant to the 
Privacy Act and who knew of the unauthorized disclosure informed Defendant VA's Inspector 
General George Opfer of the disclosure. The Inspector General only learned of the incident 
through an offhand remark on May 10, 2006. Then, the Inspector General further demonstrated 
VA's reckless disregard for the privacy rights of Plaintiffs and the Class and an intentional and 
willful disregard for Privacy Act requirements by failing to interview the employee in question 
until May 15, 2006, five days later. 

2 1 . Defendant Nicholson was informed of the patently unlawful disclosure on May 
16, 2006, and the Federal Bureau of Investigation ("FBI") was contacted on May 17, 2006. 
Defendant Nicholson did not publicly inform Plaintiffs or any other individuals of VA's patently 
unlawful disclosure of the Personal Information until May 22, 2006, 19 days after the reported 
theft. 

22. Defendants' actions and inactions in failing to report the unauthorized disclosure 
of the Personal Information were arbitrary, capricious and without observance of procedures 
required by law. 
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23. Defendant VA has been repeatedly informed of recurring, systemic, and 
fundamental deficiencies in its information security, but failed to effectively respond. VA's own 
Inspector General has for years criticized the Department for lax information security. Despite 
the repeated identification of problems, VA has been unable or unwilling to properly secure the 
personal information under its control. These repeated failures to correct known vulnerabilities 
of VA's safeguards for Plaintiffs' and class members' Personal Information demonstrated a 
reckless disregard for privacy rights and intentional or willful violations of the Privacy Act. 

24. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to observe the procedures required by law for disclosure of private 
information, including the Personal Information, without the prior written consent of the affected 
individuals. 

25. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by disclosing, or allowing disclosure of, the Personal Information to officials and 
employees who did not have a need for such records and information in the performance of their 
duties. 

26. VA flagrantly disregarded the privacy of Plaintiffs and the Class and caused them 
adverse effects by failing to keep or maintain an accurate accounting of the disclosures of the 
Personal Information. 

27. VA also flagrantly disregarded the privacy of Plaintiffs and the Class and caused 
them adverse effects by assembling and maintaining the Personal Information in a system of 
records although the information was not relevant and necessary to accomplish a purpose 
required by statute or by executive order of the President. 
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28. Defendants knew or should have known that their computer security practices 

were not in compliance with 5 U.S.C. § 552a as well as other federal laws relating to information 

security. In 2003, a study conducted by the General Accounting Office ("GAO") gave the VA a 

failing grade for its computer security practices. In March 2006, the United States House of 

Representative's Committee on Government Reform gave the VA an "F" in its annual report 

card relating to information security. Despite this ample and specific notice of noncompliance 

and the potential adverse effect of random and unauthorized disclosures of Personal Information, 

Defendants failed to establish appropriate safeguards to ensure the security and confidentiality of 

veteran records and to protect against any anticipated threats or hazards to the security and 

integrity of these records in violation of 5 U.S.C. § 552a(e)(10). 

29. An Associated Press article published on June 14, 2006, concerning that day's 

testimony in Congressional hearings on the compromise of privacy laws at the VA, reported: 

In testimony to Congress, the Government Accountability Office and Veterans 
inspector general detailed ignored warnings, weak management and lax rules in 
their review of VA information security following the theft of 26.5 million 
military personnel's private data last month. 

They found that the Veterans Affairs Department routinely failed to control and 
monitor employee access to private infonnation, did not restrict users to "need-to- 
know" data and often waited too long to terminate accounts when an employee 
quit or was fired. 

The investigators also said the VA lacked a clear chain of command in enforcing 
security, noting the agency will need dramatically stronger leadership under VA 
Secretary Jim Nicholson to force reform after five years of repeated wamings 
about security. 

"Much work remains to be done," Linda Koontz, a director on information 
management at GAO, told the House Veterans Affairs Committee. "Only through 
strong leadership, sustained management commitment and effort, disciplined 
processes, and consistent oversight can VA address its persistent, long-standing 
control weaknesses." 
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30. The testimony of June 14 made clear, according to the foregoing article, that: 

government investigators said the problem was long-standing and much more 
widespread. They pointed to repeated occasions in the last year in which VA 
employees passed along veterans' medical information via unencrypted e-mail or 
were allowed to freely log into the VA secure network in their off-duty hours or 
even after they've been terminated. 

In other instances, files were not adequately segregated or password-protected, 
making it easy for hackers to access the sensitive information. 

3 1 . Finally, the article underscored the fact that the defendants were aware of their 

privacy laws deficiencies for a very long time. 

When the VA was told of problems over the years, often it would make spotty 
improvements but fail to address reform agency-wide. The agency also has yet to 
put in place a security response program to monitor suspicious log-on activity, 
said Michael Staley, an assistant VA inspector general, in testimony. 

"These conditions place sensitive information, including financial data and 
sensitive veteran medical and benefit information, at risk, possibly without 
detection of inadvertent or deliberate misuse, fraudulent use, improper disclosure 
or destruction," Staley said. 

32. The unauthorized and unconsented disclosure of an individual's name, address, 
date of birth, health and/or disability status and Social Security number creates a substantial risk 
of identity theft and an invasion of privacy. An individual's Social Security number is the most 
usefiil identifier for retrieving information from public record databases, financial institutions 
and credit bureaus. Armed with an individual's name, address, date of birth and Social Security 
number, an identity thief is able to quickly and easily steal an identity, whereas, without such 
information, the task is difficult, time consuming and costly. Moreover, the unauthorized 
disclosure of an individual's health or disability status invades the privacy of information 
protected under law. 
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33. Recent nationwide studies confirm that, on average, victims of identity theft spend 
hundreds of hours in personal time and hundreds of dollars in personal fiinds to resolve their 
credit issues. See www.idtheftcenter.org; www.ftc-.org. 

34. Defendants' unauthorized and unconsented disclosures of private Personal 
Information and the imminent and substantial risk of identity theft to which the Class has been 
exposed is the direct result of Defendants' failure to: (1) establish appropriate administrative, 
technical and physical safeguards to ensure the security and confidentiality of records; (2) to 
protect against any anticipated threats or hazards to the security and integrity of these records; 
and (3) to promptly take reasonable measures to correct the disclosures, including but not limited 
to, providing law enforcement and the affected veterans with prompt and accurate notice of the 
disclosures, and firee ongoing monitoring of class members' health and financial reports. 

35. As a direct and proximate result of Defendants' acts and omissions, the Class has 
been exposed to a risk of substantial harm and inconvenience, and has incurred actual damages in 
purchasing comprehensive credit reports and/or monitoring of their identity and credit. 
Furthermore, their individual privacy has been invaded through the disclosure of their private and 
personal health information. 

36. Defendant Nicholson was ultimately responsible for control, direction, and 
management of VA's processes, policies, and procedures for compliance with the Privacy Act of 
1974 and other privacy laws, rules and regulations, but failed to ensure those processes, policies, 
and procedures were adequately implemented by his subordinates. Defendant Nicholson knew, 
or should have known, that VA had long-standing information security deficiencies that 
threatened the privacy rights of Plaintiffs and the Class, but did not ensure correction or 
mitigation of those deficiencies. 

10 
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37. Defendant Nicholson flagrantly disregarded the privacy rights of Plaintiffs and the 
Class and caused them adverse effects by failing to establish and ensure lawBil compliance by his 
subordinates with appropriate administrative, technical, and physical safeguards to insure the 
security and confidentiality of records and to protect against anticipated threats or hazards to the 
records security or integrity, which could result in substantial harm, embarrassment, 
inconvenience, or unfairness to any individual on whom information was maintained. 

38. . Each of Defendants* failures complained of caused adverse effects to the Class 
including, but not limited to, embarrassment, inconvenience, unfairness, mental distress, 
emotional trauma, pecuniary damages and the threat of current and future substantial harm from 
identity theft. In testimony to Congress on or about June 12, 2006, Defendant Nicholson said 
that although he remained hopeful that the thefl from the VA employee in Maryland was random, 
he and the VA could not count on the fact that no use of the stolen data was or would be made by 
unauthorized persons. 

39. The real threat of identity thefl and similar adverse effects of VA's illegal actions 
and Privacy Act violations requires affirmative actions by the Class to recover peace of mind, 
emotional stability, and personal security including, but not limited to, frequently obtaining and 
reviewing credit reports, bank statements, and other similar information, obtaining credit watch 
services, and closing financial accounts. The Class has, and will continue to, suffer tangible and 
intangible damages for the foreseeable future. 

40. In Congressional hearings held after the disclosure of the Personal Information 
discussed herein, Representative Henry Waxman of California berated defendant Nicholson for 
his conduct and malfeasance: 
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"Secretary Nicholson, you blame this on an employee who was fired, on a culture, 
on people doing what they're not supposed to be doing. That doesn't sound like 
we're getting to the heart of this with passing the buck." 

CLASS ACTION ALLEGATIONS 

4 1 . This action is maintainable as a class action pursuant to Federal Rules of Civil 
Procedure 23(a) and (b)(l)-(3). 

42. The Class consists of all persons who have been adversely effected by 
Defendants' violations of the privacy of class members' personal and private identifying 
information. 

43. This action is properly maintainable as a class action for the following reasons: 

a. The Class is so numerous that joinder of all members is impractible. The 
class size is approximately 26,500,000, which is the number of individuals whose information 
Defendants admit was collected and maintained in the missing system of records. 

b. Joinder of class members' individual actions is impractical because of the 
geographical diversity of class members, the limited ability of individual class members to 
institute separate suits, and the general nature of the underlying action and relief sought. 

c. Plaintiffs are committed to the vigorous prosecution of this action and 
have retained counsel qualified and experienced to represent the Class and familiar with class 
litigation. Plaintiffs' claims are typical of the claims of other members of the Class and plaintiffs 
have no interest that are adverse or antagonistic to the interests of the Class. Plaintiffs are 
military veterans listed in one or more VA system of records who have had their personal 
information improperly maintained and disclosed by Defendants. 

d. The representative Plaintiffs will fairly and adequately protect the interests 
of the Class. 
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e. There are substantial questions of fact and law common to all class 
members. The issues raised include whether Defendants acted or failed to act commensurate 
with their duties to protect the personal, private and confidential information of Plaintiffs and 
class members, whether such conduct violated the privacy and other laws, whether said 
violations were willful, wanton and/or reckless and whether such conduct gives rise to the 
various forms of relief requested and/or damages. The foregoing issues are common to all class 
members. Similarly, the relief Plaintiffs seek is dominated by equitable remedies. The facts, 
circumstances, and merits of the case, therefore, apply equally to all class members. 

f. Defendants have acted and refused to act on grounds generally applicable 
to the Class, making appropriate final injunctive and declaratory relief with respect to the Class 
as a whole. 

g. The prosecution of separate actions by individual class members would 
create a risk of inconsistent results that could establish incompatible standards of conduct for 
Defendants. 

h. Defendants' liability for damages can be established by facts and 
circumstances common to the Class as a whole and do not require the examination of Plaintiffs' 
individual circumstances. 

1. Questions of law and fact common to members of the Class predominate 

over any questions affecting only individual members. 

j. A class action is superior in this case to other methods for a fair and 

efficient adjudication of the controversy because the common interests of the class members 
predominate over any individual interest in controlling prosecution or control of separate actions 
and because concentrating the litigation in this Court is appropriate to ensure appropriate, 

13 
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consistent, and efficient resolution of the legal and constitutional issues raised in the district 
where the offending conduct occurred, continues to occur, and could occur in the future. 

FIRST CLAIM FOR RELIEF 

44. Plaintiffs reassert the allegations set forth in Paragraphs 1 through 43 above and 
incorporate them by reference into this First Claim for Relief. 

45. Defendant VA possesses personal information of Plaintiffs and millions of other 
veterans and active service members. VA has repeatedly demonstrated an inability or 
unwillingness to implement, or callous disregard for, fundamental procedures to provide 
minimally acceptable safeguards for the personal and private information in its possession. 

46. Defendant Nicholson is ultimately responsible in his official capacity for 
safeguarding citizen's private information under VA control pursuant to applicable laws, 
including the Privacy Act of 1 974 and the Administrative Procedures Act, but has been unable or 
unwilling to require compliance with those laws. 

47. Defendants' actions and inactions in failing to safeguard Plaintiffs' private 
information were arbitrary, capricious, and otherwise not in accordance with law. 

48. Plaintiffs suffered, and continue to suffer, harm as a result of Defendants' actions 
and from actions improperly withheld or unreasonably delayed. 

49. The Class is entitled to monetary and equitable relief for Defendants' violation of 
plaintiffs' rights pursuant to the Administrative Procedures Act. 

50. The foregoing acts and omissions of Defendant VA constitute an unauthorized, 
nonconsensual, and inappropriate disclosure of Social Security numbers and private health 
information of the Class in violation of 5 U.S.C. § 552a(b). 
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SECOND CLAIM FOR RELIEF 

51 . Plaintiffs repeat and reaffirm the assertions of fact contained in paragraphs 1 
through 50 hereinabove. 

52. The foregoing acts and omissions of Defendant VA constitute a willful and 
intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran records and to protect against known and anticipated threats or hazards to the security 
and integrity of the private personal records of the Class in violation of 5 U.S.C. § 552a(e)(10). 

THIRD CLAIM FOR RELIEF 

53 . Plaintiffs repeat and reaffirm the assertions of fact contained in paragraphs 1 
through 52 hereinabove. 

54. The foregoing acts and omissions of Defendants constitute a violation of the right 
to privacy and personal security of the Class in their Social Security numbers and private health 
information under the Fourth and Fifth Amendments to the United States Constitution. 

PRAY FOR RELIEF 
WHEREFORE, Plaintiffs pray as follows: 

a. For a declaration that Defendants' acts and omissions constitute a willful 
and intentional failure to establish appropriate safeguards to ensure the security and privacy of 
veteran and active service member records and to protect against known and anticipated threats 
or hazards to the security and integrity of these records in violation of 5 U.S.C. § 552a(e)(10) and 
the Fourth and Fifth Amendments of the United States Constitution. 

b. For preliminary and permanent injunctive relief enjoining, prohibiting and 
preventing Defendants from continuing to operate without appropriate safeguards to ensure the 
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security and privacy of veteran records and to protect against anticipated threats or hazards to the 
security and integrity of these records. 

c. For reparative injunctive relief under Bivens requiring Defendants to take 
necessary measures to safeguard against the serious harm attendant to the improper 
disclosure/theft of confidential information including an identity and/or credit monitoring 
program and a preemptive internet search service for the benefit of Plaintiffs and the proposed 
Class under the Court's supervision; 

d. That this Court permanently enjoin Defendant VA, its officers, agents, 
employees, and those acting for and with them, fi-om accessing, viewing, handling, disclosing, or 
in any way transferring any record or system of records subject to Privacy Act requirements until 
an independent panel of experts finds that adequate information security has been established and 
implemented by VA, unless such activity is explicitly allowed by Court order and under 
supervision of persons independent of VA, such supervision to be at VA expense; 

e. That this Court enjoin Defendant VA, its officers, agents, employees, and 
those acting for and with them fi-om removing any device capable of storing, containing, or 
transferring any record or system of records, including, but not limited to, laptop computers, 
portable hard drives, memory stick or similar devices, and "iPods" and similar devices, fi*om 
property under VA's supervision and control until and unless VA demonstrates that adequate 
information security has been established to the Court's satisfaction. 

f. That this Court grant to Plaintiffs and the Class judgment against 
Defendant VA for damages in an amount of $1,000.00 for each individual who was adversely 
affected by Defendant's Privacy Act violations; 
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g. That this Court grant to Plaintiffs their costs and reasonable attorneys' 
fees; and 

h. That this Court grant such additional relief as the Court deems proper and 
just. 
Dated: June 21, 2006 




Joseph H.JWebs (JW- 
Mark D. Smilow (MS-2809) 
Richard A, Acocelli (RA-2029) 
Weiss & Lurie 
551 Fifth Avenue 
New York, NY 10176 
Tel: (212) 682-3025 
Fax: (212)682-3010 
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